US Public Data LabU.S. public data, made readable
Data areas
Federal Register Congress bills CISA KEV / NVD SEC EDGAR USAspending Defense contracts Trade Economy Energy Places FDA recalls AI Research Grants NIH research grants Fiscal & national debt
Tools
Search Recent Rankings Compare Money flows Timeline Compare indicators Topics
Profiles
Company profiles Agency profiles Glossary Contact
EN▾
日本語 English
Exploited Known exploited (KEV) Ransomware use CVE-2024-4577

PHP-CGI OS command injection (CVE-2024-4577) — a path closed in 2012 still reachable through another entrance

PHP Group PHP ・Added to KEV Jun 12, 2024 ・Federal remediation due 2024-07-03

An OS command injection vulnerability in PHP used in CGI mode on Windows. The catalog describes it as a patch bypass for a 2012 vulnerability. Because a widely used component is affected, establishing the extent of exposure is difficult.

Key facts

  • CVE IDCVE-2024-4577
  • Affected (vendor / product)PHP Group PHP
  • CWECWE-78
  • ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
  • Remediation due2024-07-03 (U.S. federal civilian agencies, BOD 22-01)

Key points

  • The affected product is PHP, particularly Windows-based installations used in CGI mode, classified as CWE-78.
  • The catalog states expressly that this is a patch bypass for a vulnerability from 2012.
  • Fixes often close a particular route, so any other route to the same place remains a problem.
  • A catalog note asks that patching status be checked with individual vendors because a widely used component is affected.
  • Added June 12, 2024 with a due date of July 3, 21 days later; use in ransomware campaigns is known.

1The shape of OS command injection

A program may build an instruction for the operating system by embedding a string received from outside. Where special characters within that string are read as instruction separators, further instructions that were never intended may run. That is the class of flaw called OS command injection.

What is intendedWhere the flaw exists
The string received is treated as a value within one instructionCharacters in it are read as instruction separators
What runs is decided by the programFurther instructions may run
Special characters are neutralizedNeutralization is insufficient or absent

The neutralization in the class name means handling characters that could be read as instruction so that they are treated as ordinary text. Where that handling is incomplete, the flaw remains.

2Described as a patch bypass

  1. 12012A vulnerability of the same kind is reported and fixed
  2. 2AfterwardsThe path is treated as closed by that fix
  3. 32024 (this entry)The same place proves reachable through another entrance
  4. 4The catalog recordStates expressly that this is a patch bypass for the 2012 vulnerability

What stands out is that this is not a newly introduced flaw but a path believed closed twelve years earlier, still reachable another way. Fixes often close a particular route, and any other route to the same place remains. This site separately covers a case where later updates were said to include more robust protection, showing how repeatedly the completeness of a fix comes into question.

3A widely used component

The catalog noteAffects a widely used open-source componentAsks that patching status be checked with specific vendors
Added to the catalogJune 12, 2024Due date July 3, 21 days later
Establishing exposureMay be present without direct adoptionComponents may be embedded within products

The catalog asks that patching status be checked with individual vendors because a widely used component is affected. Something never deliberately installed may still be present inside a product. Not being able to determine within one organization what is affected is the particular difficulty of this class.

4The conditions are narrow

The description names Windows-based installations used in CGI mode in particular. The same product can be affected or not depending on how it is run. Judging applicability requires checking configuration as well as version.

Why it matters

A vulnerability in a widely used component may be present without direct adoption, embedded inside products, so exposure cannot be established from within one organization alone. Checking with each vendor becomes a precondition.

FAQ

What is OS command injection?
A flaw where special characters in a string received from outside are read as instruction separators, allowing instructions that were never intended to run.
What does patch bypass mean?
That a place believed closed by an earlier fix proves reachable through another entrance. It differs from a newly introduced flaw.

Related explainers

Sources (primary)

This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.

#Security#CISA#KEV#PHP#Command injection

← Back to vulnerability alerts

Disclaimer: This site independently summarizes and classifies information based on official data sources. Always verify the latest and accurate information with the official sources. Content on finance, health, legal, and security is information, not advice. This site is not an official website of the U.S. government.